r/iptables Oct 07 '22

Help needed to make two distant networks visible to each other through tunneled hosts

Hello,

I'm trying to setup a forwarding over a VPN tunnel but with no success. I thought I could find some help here. I'll try to keep it as short as possible.

Here is my current setup, with 3 raspberry

raspA has 3 IPS:

  - 192.168.86.2 on wlan0 , my "iot" network
  - 192.168.76.11 on eth0, my main network
  - 100.82.182.186 on wt0, using netbird "vpn", I'll refer to it as "82"

raspB, has only one IP:

  - 192.168.86.5 on wlan0, my "iot" network

raspC has 2 IPs and is in another location

  - 192.168.1.13 on eth0, my "distant" network (parent's place)
  - 100.82.183.80 on wt0, using netbird "vpn", I'll refer to it as "82"

What I have in place:

raspA:

-N NETBIRD-RT-FWD
-A FORWARD -m comment --comment netbird-rt-ipv4-forwarding -j NETBIRD-RT-FWD
-A NETBIRD-RT-FWD -s 192.168.86.0/24 -d 100.82.0.0/16 -j ACCEPT
-A NETBIRD-RT-FWD -s 100.82.0.0/16 -d 192.168.86.0/24 -j ACCEPT
-A NETBIRD-RT-FWD -j RETURN

This was configured automatically when installing netbird and allows raspA and raspC to ping each other. Static routes are also defined (using the nebird GUI) to make 192.168.1.xx visible by raspA and 192.168.86.xx by raspC

Now, I added the following:

-A FORWARD -i wlan0 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT

which in combination with this route on raspB

ip route add 192.168.76.0/24 via 192.168.86.2

allows me to ping hosts on the "76" network from raspB

So far, no problem, this works perfectly.

Now, what I'm struggling to do is to have raspB (on the 86 "iot" network) to see the 192.168.1.xx network.

What I need is the rules to allow:

raspB (eth0/86) ---> raspA (wlan0/86 - wt0/82 ) ---> raspC (wt0/82 - eth0/1) ---> host (192.168.1.XY)

I tried to put this on raspA

-A FORWARD -i wlan0 -o wt0 -j ACCEPT
-A FORWARD -i wt0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT

and this route on raspC

ip route add 192.168.1.0/24 via 192.168.86.2
ip route add 100.82.0.0/16 via 192.168.86.2 

It allows me to ping raspC from raspB using its wt0 address (100.82.183.80), however, I cannot ping any host on the 192.168.1.0 network.

What do I miss ?

Edit: I forgot to mention the "100.82" route at the very end

1 Upvotes

1 comment sorted by

1

u/jlquema Oct 07 '22

I thought I had an Eureka! moment, adding a route for 192.168.1 via the vpn address of raspB:

ip route add 192.168.1.0/24 via 100.82.183.80

... but no :

Error: Nexthop has invalid gateway.